REPAYD

Demo

About

REPAYD is deposit insurance for AI agent wallets: a protected account that holds suspicious transactions for two minutes while a sealed, tamper-proof verifier checks them against the owner's rules, blocks outright violations, cryptographically proves who actually issued each instruction (so no one can fake an attack to collect a payout), and — for whatever slips through, like a prompt-injection attack that tricks an agent into transferring funds — pays the owner back automatically in the same block, no claims process required; it prices each agent's coverage based on its real behavior over time so safer agents get cheaper every week, and sells the whole system as an API to the platforms launching AI agents, so that instead of competing with the firewalls and prevention tools already on the market, REPAYD sits behind all of them as the layer nothing else has: guaranteed recovery, the same force that scaled banks (deposit insurance), cars (liability insurance), and credit cards (chargebacks), now built for the agent economy.

How it's made

How we built REPAYD — the nitty-gritty Stack. Solidity ^0.8.28 on Foundry (5 contracts: GuardAccount, PolicyRegistry, VerdictContract, MutualPool, Blocklist + a deploy-seeded USDCMock), a Bun workspaces monorepo (engine, sdk, api, demo, dashboard, pricing, record, hedera, subgraph) in strict TypeScript, viem for all chain I/O, and a Next 16 + React 19 frontend (authored pages synced from the dashboard HTML, anime.js transitions, lenis scroll). 102 forge tests including 1000-run fuzz invariants; 200+ JS tests; CI runs contracts, tsc per-package, every runner, and both subgraph builds. How it's pieced together. The classification decision is deliberately tiny and on-chain: _classify() is a pure function of policy × transfer × daily-state — hard caps (per-tx/daily/velocity/blocklist) revert before broadcast, allowlist-absence/curfew/strikes route to a funded hold with a releaseAt window, everything else executes instantly. Verdicts are EIP-712 signatures over a domain that embeds block.chainid + contract address + salt, so a signature can't be replayed on another deployment, and every verdict pins an exact policyHash so it can't be replayed against a different rulebook. A covered verdict calls MutualPool in the same transaction as the payout. The off-chain half (pricing engine, alibi SDK) mirrors the on-chain logic function-for-function — same inputs, same verdict — which is what makes the payout parametric rather than an opinion. The Risk Subgraph (38 events, 12 entities) is not decoration: the live AI pricing consumer queries the Studio endpoint and computes the premium multiplier (2.7×, $135/mo) from indexed claims/attempted-breach data with zero hardcoded inputs. Partner technologies. Arc made the demo moment possible — USDC-native gas and fast blocks meant "payout in the same block as the verdict" is a literal transaction, and gas-priced-in-USDC let us measure real deployment cost (~0.36 USDC per fresh stack). The Graph Studio (free tier) gave us a public, standard-schema memory layer for ~$0. Hedera contributed the x402 machine-payment rail through the Blocky402 testnet facilitator — two real 0.001ℏ settled requests, HCS topic receipts, and a ScheduleCreate demoing recurring-premium draws. Circle Agent Stack gave authenticated wallet-set/Gateway-balance reads across 12 domains. ERC-8004 canonical registries (agentId 894341) gave us a standards-compliant reputation mirror with fail-closed posting (frozen holds post nothing). The hacky parts worth admitting. 1. Our own demo narrative lied to us: the "look-alike address one hex off Alice" was narrated as bypassing the firewall, but exact-match allowlisting means an off-by-one address is just a new recipient — held, not executed. We rewrote the beat as a labeled controlled watcher false-negative (benign facts → score below threshold → signed clean release → verified real $150 out → then the covered verdict pays $135). A parametric product can't fake its own loss. 2. demo.ts called main() twice. Duplicate payroll spends blew the $1,000/day cap in ways we initially blamed on RPC races — the actual cause only surfaced when we ran a one-second dailyState monitor loop against the live chain. 3. Run integrity is now a server-owned RunManager: the child signs against its own fresh deployment, emits structured @@DEMO_TX@/@@DEMO_RESULT@ markers, and "Complete" requires verified receipts + balance-delta checks on all six story beats — exit code 0 alone fails the run. 4. Crash-safety hack we're weirdly proud of: an OS-scoped SQLite BEGIN EXCLUSIVE connection held for process lifetime as the signing lock (the OS releases it even on SIGKILL; you must never unlink the lock inode — our first PID-file scheme had its own check-then-unlink TOCTOU race), plus a Bun IPC channel where the worker exits on parent disconnect so a killed dashboard can never leave two processes spending the same funded testnet keys. 5. Honest labeling as architecture: every displayed fact is VERIFIED or COMPUTED, never INFERRED; the UI states "local demo signer (not a live TEE)" because the watcher key is scripted for the hackathon and CRE/TEE hosting is the documented production path; the Circle endpoint refuses dashboard GETs with a 405 because the legacy route could provision/spend — you must POST an explicit confirmation.